CVE-2023-40047: 
WS_FTP Server vulnerability analysis and mitigation

A stored cross-site scripting (XSS) vulnerability exists in WS_FTP Server's Management module, tracked as CVE-2023-40047. The vulnerability affects WS_FTP Server versions prior to 8.8.2. This high-severity vulnerability has been assigned a CVSS score of 8.3 by Progress Software Corporation (Progress Advisory).

The vulnerability exists in WS_FTP Server's Management module where an attacker with administrative privileges could import an SSL certificate with malicious attributes containing cross-site scripting payloads. Once the cross-site scripting payload is successfully stored, it could be triggered to execute malicious JavaScript within the context of the victim's browser (NVD, Hacker News).

If successfully exploited, the vulnerability allows attackers to execute arbitrary JavaScript code within the context of the victim's browser when WS_FTP Server admins access the affected components. This could potentially lead to unauthorized access to sensitive information or manipulation of admin sessions (Tenable Blog).

Progress Software has released version 8.8.2 of WS_FTP Server to address this vulnerability. Organizations using affected versions should upgrade to the patched version immediately. For WS_FTP Server 2020, users should upgrade to version 2020.0.4 (8.7.4), and for WS_FTP Server 2022, users should upgrade to version 2022.0.2 (8.8.2) (Progress Advisory).